5 Misconceptions Small Business Clients Have about Risk

Posted by Susan S. Coffey, CPA, CGMA on Aug 25, 2015

When small business owners want or need to address risk, they often turn to their CPA as a trusted adviser for guidance. Risk is a significant issue for companies of all sizes; in a recent CGMA report, “Global State of Enterprise Risk Oversight, 2nd Edition,” the AICPA and its partner, the Chartered Institute of Management Accountants, examine the challenges facing large and small companies and consider how investment in enterprise risk management can strengthen an organization’s resiliency and agility.

When organizations, particularly small ones, search for ways to minimize risk, there is a tremendous opportunity for CPAs to provide value. That’s because many companies misunderstand or underestimate the risk factors they face. Here is a look at five misconceptions that your small business clients may have about risk.

1. This Is Not Our Problem

Risk is every business’ problem. The CGMA report found roughly 60% of organizations face a wide range of complex and expanding risks. However, no more than 35% have a formal enterprise risk management plan. While many small business owners believe that this kind of plan doesn’t apply to organizations of their size, CPAs are able to help them understand the benefits of incorporating risk considerations into strategic planning. The CGMA report notes that “unfortunately, many executives view risk management as mostly focused on compliance and loss prevention with little connection to strategy and value creation.

2. We Have It under Control

The report’s findings note that business owners and senior management benefit from an honest assessment of their risk oversight in light of a constantly changing risk environment. In fact, most respondents characterized their risk oversight processes as relatively immature. That could certainly be the case in a closely-held business. Owners assume they are managing the threats they face, but a robust CPA-led examination of their process may tell a different story.

3. We Know Which Risks to Address

Your clients will likely be surprised by the risks they may have overlooked. Risks for the smaller organization could include anything from failing to prepare for a smooth transition to a new generation of leadership and miscalculating marketplace changes -- especially the global and Internet-based market -- to missing new opportunities and neglecting some compliance issues. Business owners should take a closer look at a broad range of potential risks and address them with a CPA’s guidance.

4. We’re Too Small to Have a Risk Oversight Process

Small companies certainly don’t need the kinds of complicated approaches used by large corporations, but an organized, well-thought-out process can be more effective than an ad hoc method. The CGMA report notes that organizations traditionally use a silo approach, where each department manages the risks it identifies with little coordination across divisions. This means that, even in a small company, departments may not be sharing crucial insights on risk and may be duplicating efforts. CPAs can help their clients identify the threats they face and work with them to create a strategy that takes a more holistic approach.

5. Risk Is Everyone’s Responsibility

That’s true, and it’s a good mantra for any organization. But the CGMA report recommends appointing an individual to take responsibility for risk management. In a small company, it’s not necessary to hire someone to take on this job. It may be the business owner, or it may be delegated to an experienced senior employee. Having a champion who is accountable for creating and implementing an ongoing overall risk strategy makes it more likely that the approach will streamline the company’s efforts and enhance its effectiveness.

Offering the Big Picture

Small business owners frequently devote all their time to day-to-day operational issues and may not stop to get a big picture view of the larger or long-term challenges they should address. A strategic approach to risk management could help them shift from putting out fires -- or paying unexpected fines or penalties -- to anticipating their needs and minimizing the costs and disruptions associated with risk.

How can you help your clients take a more efficient approach to risk management?